The Delegate-Downwards Ratchet: Fire Your Frontier Model One Task at a Time

A ratchet is a humble tool with one profound property: it converts oscillation into progress in a single direction, and it holds. Crank forward, the pawl clicks over the teeth; let go, and the load does not slip back. There is a reverse lever for when you genuinely need to back off — but backing off is a decision, never an accident.

I run a portfolio of small companies on an LLM agent harness, which means I face the same question every operator of recurring agent work faces: which model does this task actually deserve? The frontier model is the best and the most expensive — in dollars if you pay per token, in scarce usage budget if you don’t, and in either case in the resource that matters most, which is your attention while supervising it. The cheap model is twenty times cheaper and fine for some things. A plain script is free and fine for fewer things. Most teams answer the question once, statically, by feel — and then never revisit, so they end up paying frontier prices forever for work a script could do, or worse, handing real work to a cheap model on optimism.

I’m open-sourcing the protocol I use instead. It’s called the delegate-downwards ratchet, and the whole trick is in the name: work migrates down the ladder — frontier model → mid-tier → small model → deterministic script — exactly as fast as logged evidence supports, it holds position under load, and the reverse gear is automatic.

The premise: it’s a harness-maturity ladder, not an intelligence ladder

Here is the reframe the whole protocol rests on. A task sits at a high tier not because the task is hard forever, but because the harness around it — the rules, templates, evals, and scripts that constrain it — is immature. When my bookkeeping agent first categorized bank transactions, it needed a frontier model because nothing was written down: no vendor rules, no format quirks, no list of the ways deposits lie to you. Every one of those things is learnable, and once learned and written into the harness, the intelligence requirement drops.

This isn’t a hunch; it’s now a public, measured result. In early 2026, LangChain’s team took their coding agent from outside the top 30 to the top 5 on Terminal-Bench 2.0 — 52.8% to 66.5% — without changing the model at all: better system prompts, forced verification loops, environmental context injected up front, middleware that catches doom loops (their writeup is worth your time). Twenty-five leaderboard places, and the model never got smarter. The harness did.

So the protocol’s first demand is this: every supervised high-tier run must emit harness artifacts. A rule captured. A script extracted. An eval case added. Corrections are the strongest labeled failure data you will ever get — a correction that produces no artifact is wasted tuition. The harness compounds; the task gets cheaper to run correctly; the expensive model works itself out of a job. That’s not a cost-cutting trick. That’s what supervision is for.

The moving parts

A routing table. Every recurring task gets a stable name, a tier, and an objective test of success. No name, no ratchet. Demotion is a one-field edit to this table — reviewable, diffable, instantly revertible.

A run ledger. One JSON line per run, append-only: tier, harness version, verdict, corrections, deviations from a closed failure vocabulary, the trajectory of steps taken, and a boundedness signal — how many times the agent had to ask a clarifying question or escalate. You cannot ratchet on evidence you didn’t record.

The demotion gate: pass^k. A task becomes a demotion candidate only after k consecutive clean runs at a pinned harness version — I use k=3. Consecutive is the point. A model that passes 61% of single attempts passes fewer than 25% of eight-in-a-row sequences — that’s the τ-bench arithmetic reported in the Agent Skills whitepaper of Google’s 2026 agents series (Singhal, Hernandez Larios, Dus, Nigam & Kolan), and it’s why a lucky pass counts for nothing. And “clean” is strict three ways: zero human corrections (any correction resets the streak — and gets banked as an artifact); clean trajectories, not just clean outputs (a run that produced the right answer but skipped its verification step is a failure, whatever the output looks like); and, for demotion all the way to a script, bounded interaction — zero clarifications, zero escalations, because a task that still needs to ask questions is not one well-formed request yet, and wrapping judgment in a fire-and-forget script just makes it fail silently.

An independent validator. Before cutover, the candidate cheaper tier runs in shadow against a golden set, and a fresh top-tier inspector that did none of the work judges the result. Hard rule: the validator never shares a write scope with the worker it validates. Functional checks can be gamed — tests can be deleted, mocks can be installed; a validator the worker can edit is no validator at all.

Golden sets. Twenty-plus cases per demotion candidate, in plain Given/When/Then form, including two kinds most eval suites skip: adversarial rephrasings — the same real-world event under a different descriptor must produce the same answer — and escape-hatch cases, inputs that must route to a human review queue and must not be guessed. A plausible guess on an escape-hatch case is a hard fail. If your eval set never tests whether the agent knows when to stop, you are not testing the thing that ruins ledgers.

The reverse gear. The first post-demotion failure promotes the task back up a tier immediately. Revert the routing entry, log the failure kind, start a cooldown. The ratchet holds position on evidence and gives it back on evidence; it never argues.

And one thing that never ratchets away. Any script that moves money or sends anything to another human being must stop, immediately before executing, and show a person a plain-English summary of what is about to happen. For a payment: who gets paid, how much, from which account. For an outbound message — an email, a text, anything with a recipient — the same discipline applies: who it goes to, what it says, from which address. The script waits for a yes. This isn’t a clever mechanism with a name; it is ordinary human-in-the-loop discipline, kept on purpose at the bottom of the ladder. Reaching the script tier removes the model. It never removes the human’s final read — and that is the difference between automation and abdication.

Two directions down

Everything above moves a task down a tier — same task, cheaper model. But there is a second way down the ladder that the tier-swap can’t see: splitting the task apart. A frontier-model task is often not one indivisible thing; it’s a deterministic spine with a knot of real judgment tied into it. Once the harness is mature enough to expose the seam, you don’t demote the whole task — you decompose it: carve the deterministic part into a script, fan the parallelizable part across a swarm of the cheapest model, and leave only the irreducible judgment up a tier. My bookkeeping task already went this way before I had a name for it — the importing and the statement math are plain scripts now; only the categorization judgment still needs a model at all. The vertical move asks “can a cheaper model do this same task?” The split asks the question the vertical move is blind to: “does this need to be one task at all?” The same evidence discipline gates it — each fragment becomes its own named task with its own eval — and the two moves compose: a fragment you split out then rides the tier ladder down on its own.

Why it’s a servo, not a winch

A one-way ratchet has an honest flaw. Left alone, it only ever pulls in one direction, and the direction is cheaper. Point enough downward pressure at a system and it will find the lowest tier that technically passes the test — while quality quietly bleeds out through everything the test doesn’t measure. A binary did it pass is easy to satisfy and easy to game.

So the real thing isn’t a winch cranking one way; it behaves like a servo — a controlled loop with forces pushing back. Around the downward pressure I run a standing panel of reviewers, deliberately set against each other. One force pushes work cheaper: the tier ratchet, the split gate, a process reviewer that hunts wasted steps and gates that have never once caught anything, a cost reviewer watching both currencies. A second force pushes the other way, to protect quality: a quality inspector that grades every task on a real rubric — not pass/fail but weighted dimensions with a floor, so a demotion that still “passes” yet drops below the floor is blocked, not celebrated; and a regression sentinel that catches the slow drift a single failure never trips — the task that keeps passing but always needs the same little nudge. A third force just keeps the ledger honest: is every recurring task even named? Did every correction actually produce a rule? Did any demotion quietly strip a human-approval gate?

The panel is built to disagree. When the cost reviewer wants a demotion the quality floor forbids, the conflict doesn’t resolve itself in favor of cheaper — it surfaces as a decision, evidence attached, for a human to make. That is the whole difference between a system that saves you money and a system that saves you money while you aren’t watching it lose you something worse.

Why bother

Because both failure modes are expensive and only one of them is visible. Undertrust — leaving everything at the frontier tier — costs money and usage budget, and you can see it on the invoice. Overtrust — demoting on optimism — costs correctness, silently, in exactly the work you stopped watching. The ratchet is engineered asymmetrically for that reason: demotion requires accumulating evidence, reversal requires a single failure. It fails safe in the only direction that matters.

The deeper economics: your scarcest resource isn’t tokens, it’s attention. The entire point of moving proven work down the ladder is to concentrate human review where models still fail — which is also the only place it teaches anything.

There is a wider ledger too. Every task that ratchets from a frontier model down to a small model — and finally to a script that uses no model at all — is compute you stop consuming, week after week, forever. If you carry any weight about what data centers cost the world — the energy, the water, the silicon, the communities that host them — the ratchet is a discipline for taking what AI genuinely gives while steadily shrinking what it takes: frontier compute spent only where it still earns its keep, and retired the moment it doesn’t. The terminal state of every well-harnessed task is the cheapest and cleanest artifact in software: a plain script, running for free.

Take it

The protocol, the run-record schema, the golden-set format, and a reference implementation (stdlib-only Python you can drop into any harness) are published at github.com/PLACEHOLDER/delegate-downwards-ratchet — Apache 2.0 for code, CC BY 4.0 for prose. The evidentiary standards inside — pass^k, boundedness, validator independence, trajectory-over-output evaluation — are adapted with citation from Google’s six-paper agents whitepaper series; the ratchet’s addition is the longitudinal machine: corrections feeding demotion decisions over time, with an automatic reverse gear.

It has two siblings from the same working system: Entity OS, the full pattern for running small legal entities on plain text and agents, and the presuppositional LLM wiki, for knowledge bases with a declared point of view. Each stands alone.

Start with the spec; it’s self-contained. Then pick your most boring recurring agent task, give it a slug, and start logging runs. The first click of the ratchet is free.

And if you’d rather have the discipline installed than build it: this is what my agency does for clients. Clineo brings automation with exactly these guardrails — evidence before trust, humans gating everything that matters — to independent healthcare practices. The Automation ROI Calculator will tell you in about two minutes what your practice’s repetitive work is costing; if the number moves you, book a call.